CVE-2024-26369

The CVE-2024-26369 entry affects the HistoryQosPolicy component in FastDDS, specifically in versions v2.12.x, v2.11.x, v2.10.x and v2.6.x. The underlying issue causes a SIGABRT (signal abort) when DataWriter data is received. Connected sources corroborate this as the core vulnerability across mul...

CVE-2023-40280

OpenClinic GA 5.247.01 is affected by CVE-2023-40280 due to a directory path traversal via the Page parameter in a GET request to popup.jsp. The issue is described consistently across sources (NVD/Red Hat/CNNVD/CVE List), with an attack vector described as network-accessible and a high impact in ...

CVE-2024-28715

CVE-2024-28715 affects DoraCMS v2.18 and earlier. A cross-site scripting issue in the markdown0 function of /app/public/apidoc/oas3/wrap-components/markdown.jsx allows remote attackers to execute arbitrary code. Multiple connected sources confirm this, including Red Hat and PT Security. Mitigatio...

CVE-2023-40276

OpenClinic GA 5.247.01 contains an unauthenticated file download vulnerability in pharmacy/exportFile.jsp. The issue allows unauthorized access to files, with CVSS v3.1 base score 9.1 (CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). No exploitation details are provided in the primary CVE entry. R...

CVE-2024-28394

The CVE-2024-28394 issue affects Advanced Plugins reportsstatistics versions 1.3.20 and earlier, allowing a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom Fields & Export module. The vulnerability is documented across multiple sources (NVD/Red Hat/CVE List) wi...

CVE-2024-28303

Open Source Medicine Ordering System v1.0 is vulnerable to a SQL injection via the date parameter in /admin/reports/index.php. Affected component: the web application’s reports endpoint. Root cause (as described): unsafely interpolating user-supplied date input into SQL queries leading to potenti...

CVE-2024-28447

The CVE-2024-28447 entry concerns Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 (v1.2.9). The issue is a buffer overflow triggered by the lan_ipaddr parameter in the /apply.cgi API endpoint. CVSS 3.1 metrics indicate Adjacent attack vector, Low attack complexity, No privileges required, No ...

CVE-2024-28250

CVE-2024-28250 affects Cilium’s eBPF dataplane in versions prior to 1.14.8 and 1.15.2 when WireGuard is enabled. In these releases, wireguard-eligible traffic between a node’s Envoy proxy and pods on other nodes, and between a DNS proxy and pods on other nodes, could be sent unencrypted in cluste...

CVE-2024-28249

Cilium CVE-2024-28249 : In clusters with IPsec enabled and Layer 7 policies, IPsec-eligible traffic between a node’s Envoy proxy and pods on other nodes, and between a node’s DNS proxy and pods on other nodes, is sent unencrypted. This affects versions prior to 1.13.13, 1.14.8, and 1.15.2. The is...

CVE-2024-24578

CVE-2024-24578 affects RaspberryMatic / OCCU prior to 3.75.6.20240316. The vulnerability stems from multiple issues in the Java HMIPServer.jar, enabling unauthenticated RCE via the Firmware upload UI at /pages/jpages (Zip Slip). An attacker can upload a malicious archive that is extracted without...

CVE-2024-0951

CVE-2024-0951 affects the WordPress plugin Advanced Social Feeds Widget & Shortcode (versions

CVE-2024-0858

CVE-2024-0858 affects the Innovs HR WordPress plugin up to version 1.0.3.4. The issue is due to missing CSRF checks in certain areas, potentially allowing a logged-in attacker to perform actions (e.g., adding employees) via CSRF, with high impact on confidentiality, integrity, and availability (C...

CVE-2024-0973

The CVE-2024-0973 entry relates to the Widget for Social Page Feeds WordPress plugin, prior to version 6.4. It is described as Stored XSS caused by insufficient sanitization/escaping of plugin settings, enabling high-privilege users (e.g., Administrators) to inject scripts even when unfiltered_ht...

CVE-2024-0820

The CVE-2024-0820 vulnerability affects the WordPress plugin Jobs for WordPress prior to version 2.7.4. The issue is a stored XSS flaw caused by insufficient sanitization/escaping of certain parameters, enabling a user with as low as Contributor privileges to inject script through inputs (e.g., o...

CVE-2024-0719

CVE-2024-0719 affects Tabs Shortcode and Widget for WordPress (

CVE-2024-0779

The CVE-2024-0779 entry concerns the WordPress plugin Enjoy Social Feed (

CVE-2024-0365

CVE-2024-0365 affects the WordPress plugin Fancy Product Designer prior to version 6.1.5. The issue arises from improper sanitisation/escaping of a parameter before it is used in a SQL statement, leading to a SQL injection that is exploitable by administrators. Affected versions:

CVE-2024-0780

The CVE-2024-0780 affects the WordPress plugin Enjoy Social Feed (versions up to 6.2.2). The underlying issue is Broken Access Control: the database reset function lacks authorization, allowing any authenticated user (e.g., Subscribers) to reset the plugin’s database. Reported CVSS v3.1 base metr...

CVE-2023-41334

CVE-2023-41334 affects Astropy core package version 5.3.2, with remote code execution due to improper input validation in TranformGraph().to_dot_graph. A crafted savelayout value can be injected into subprocess.Popen, causing the malicious command to execute despite an error. The issue is fixed i...

CVE-2024-21662

CVE-2024-21662 (Argo CD) is a brute-force protection bypass caused by a weak cache-based login attempt tracker. The vulnerability centers on a per-user login attempt cache capped at 1000 entries (defaultMaxCacheSize). An attacker can overload the cache with login attempts for many users, causing ...